Boards Struggle with AI Oversight: How Internal Auditors Can Bridge the Gap

Boards Know the Stakes, But Lack Clarity

Recent research from McKinsey, Deloitte, and PwC consistently highlights a critical disconnect: while boards acknowledge AI's strategic importance, they often lack confidence in their ability to govern it effectively. Key issues include:

• Lack of expertise and clear structures for AI governance.
• Unclear responsibility for AI oversight among committees.
• Risk discussions that lag behind AI adoption.
• Difficulty balancing innovation with risk management.
• Insufficient reporting on AI deployment and monitoring across the enterprise.

This consistent message indicates that boards are eager for responsible AI oversight but need actionable insights and trusted internal perspectives.

Audit Committees Are Looking for Help

Audit committees, already responsible for risk oversight, controls, compliance, and assurance, find AI touching all these areas. However, AI introduces new and complex risks such as model bias, ethical failures, data privacy breaches, regulatory exposure, and overreliance on automated decisions. It also presents opportunities like faster insights and improved fraud detection. Internal auditors, with their understanding of processes, controls, risks, and technological impact, are well-positioned to provide the independent insight audit committees need.

5 Ways Internal Auditors Can Support Board Oversight of AI

Internal audit should proactively lead in strengthening AI oversight. Here are five practical approaches:

1. Map Where AI is Used Across the Organization

   Many boards lack a basic inventory of AI use. Internal audit can create this by documenting where AI is deployed (core systems, finance, HR, customer analytics, third-party platforms), identifying owners, clarifying purpose, and noting data sources. This provides visibility, establishes a governance baseline, and uncovers 'shadow AI'.

2. Assess AI Governance Design and Maturity

   Beyond approving AI principles, internal audit can evaluate how these principles are applied in practice. This includes assessing ownership of AI risk, approval processes for AI decisions, how ethics and bias are addressed, accountability mechanisms, and governance of third-party AI tools. Comparing current practices against leading frameworks helps highlight gaps and strengths.

3. Evaluate Controls Over Data, Models, and Outputs

   AI risk begins with data. Internal audit can evaluate controls throughout the AI lifecycle, focusing on data quality and integrity, access controls for training data, model development standards, change management, output validation, and monitoring for drift and bias. This aligns with traditional audit skills and addresses board concerns about reliability and explainability.

4. Translate AI Risk into Business and Regulatory Terms

   Boards often struggle with technical jargon. Internal audit can bridge this gap by translating AI risks into understandable business terms such as financial misstatement, compliance exposure, reputational impact, operational disruption, and strategic failure. Linking AI risks to enterprise risk statements and evolving regulatory expectations improves board understanding and decision-making.

5. Provide Continuous Insight, Not One-Time Assurance

   Given AI's rapid evolution, annual reviews are insufficient. Internal audit should adopt a continuous approach, incorporating ongoing risk monitoring, periodic governance check-ins, targeted reviews of high-risk use cases, and regular reporting to audit committees. This dynamic oversight aligns with the nature of AI and board expectations.

A Defining Moment for Internal Audit

Boards are struggling with AI oversight not due to a lack of interest, but due to a lack of clarity, information, and practical guidance. Internal audit can fill this gap by offering independence, an enterprise-wide perspective, and credibility. By proactively raising issues, providing a roadmap from visibility to assurance, and remaining engaged as AI evolves, internal audit can become the essential resource boards need to navigate the AI landscape effectively.